CVE-2026-18169: IBM Financial Transaction Manager (FTM): Information Disclosure via Symbolic Links
IBM has published CVE-2026-18169 for IBM Financial Transaction Manager (FTM), including the variant for Red Hat OpenShift. The record describes a remote authenticated attacker obtaining sensitive information because symbolic links are not properly validated, and it carries a CVSS score of 9.9 with a CWE-22 classification. The sources consulted do not show confirmed exploitation, and the record lists no fixed versions, so administrators should consult the IBM advisory.
Overview
IBM Financial Transaction Manager (FTM) is affected by CVE-2026-18169, a vulnerability the record describes as improper validation of symbolic links. The record maps it to CWE-22 (Path Traversal) and lists IBM as the CNA. The IBM support page is the vendor advisory referenced in the record.
Impact
The record states that a remote authenticated attacker could obtain sensitive information. IBM's CVSS 3.1 score in the record is 9.9 (critical), with the vector indicating high confidentiality, integrity and availability impact. The SSVC data in the record lists technical impact as total and automatable as no.
Affected products and versions
- IBM Financial Transaction Manager: the record gives a range from 4.0.7.0 up to before 4.0.11.0, and version 4.0.6.0 together with its listed interim fixes.
- IBM FTM for Red Hat OpenShift: the version text in the record is malformed and cannot be parsed reliably, so the exact affected list must be taken from the IBM advisory.
Exploitation status
The CISA KEV catalog does not list this CVE, and the SSVC exploitation value in the record is none. No confirmed exploitation appears in the sources consulted. EPSS gives a low probability score of 0.00537 at the record date.
Remediation and mitigation
- Check the IBM advisory for the fix level for your product and deployment, including the OpenShift variant.
- The record lists no fixed versions. The upper boundary of 4.0.11.0 in the range suggests a later fix level, but this is an inference and is not confirmed.
- Limit authenticated access to FTM to users who need it, and apply the principle of least privilege to accounts.
- Review file system permissions and handling of symbolic links in the deployment as a defensive hardening step.
Detection guidance
- Review authentication logs for unusual or unexpected access by authenticated accounts.
- Monitor access to sensitive data stores and configuration files used by FTM for abnormal activity.
- Keep audit logging enabled and forward it to centralized monitoring.
Limitations of the available information
The record does not provide fixed versions, a complete affected product list for OpenShift, or detailed technical conditions. The affected version text for the OpenShift variant is corrupted. The IBM advisory was not reviewed in full for this analysis, so its exact guidance should be verified directly.
Frequently asked questions
What is CVE-2026-18169?
It is a vulnerability in IBM Financial Transaction Manager (FTM), including the Red Hat OpenShift variant, where the record describes improper validation of symbolic links that could let a remote authenticated attacker obtain sensitive information.
Is this CVE being actively exploited?
No confirmed exploitation appears in the sources consulted. The CVE is not listed in the CISA KEV catalog, and the SSVC exploitation value in the record is none.
Which fixed versions should I use?
The record does not list fixed versions. Consult the IBM advisory referenced in the record to confirm the correct fix level for your product and deployment.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.